SB2023051754 - Multiple vulnerabilities in Jenkins Ansible plugin

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023051754

SB2023051754 - Multiple vulnerabilities in Jenkins Ansible plugin

Published: May 17, 2023

Security Bulletin ID SB2023051754
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Cleartext storage of sensitive information (CVE-ID: CVE-2023-32982)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin stores these extra variables unencrypted in job config.xml files on the Jenkins controller as part of its configuration. A remote user can view these extra variables.


2) Information disclosure (CVE-ID: CVE-2023-32983)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin does not mask extra variables displayed on the configuration form. A remote user can gain unauthorized access to sensitive information on the system.


Remediation

Install update from vendor's website.

References